Rule ordering. Watchguard XCS

Content Control

ƒ Decrypt — Redirects the message to the Decryption server specified in the Configuration > Mail

> Encryption > External Encryption menu.

ƒ Archive — Redirects the message to an archive server specified in the Configuration > Mail >

Archiving menu. Archive priority can be set to Low , Medium , and High .

14. Enter an optional email address to send a BCC (Blind Carbon Copy) of the message to if the rule is triggered.

15. Select the Train options for this rule if it is triggered.

ƒ Intercept decides — The Intercept Anti-Spam engine will decide whether to train the message as spam or legitimate mail based on its scanning results.

ƒ Do not train — The message will not be trained.

ƒ Train as ham — The message will be trained as a legitimate (ham) message.

ƒ Train as spam — The message will be trained as a spam message.

16. Click Apply .

Rule ordering

The rules are processed in order as displayed. Rules can be re-ordered by selecting a specific rule and dragging it to its desired location. Click the Save Rule Order button to save the updated order of your rules when you are finished.

Downloading and uploading content rules

You can download and upload the Content Rules list as a single file. It is recommended that you download the

Content Rules file first by clicking Download Rules To File , edit the file as required, and upload it using the

Upload Rules From File button.

The file (content rules.csv) should be created in csv file format using a text editor.

The file contains comma separated entries in the form:

[Policy],[Stage],[Rank],[Name],[Description],[Enabled],[Condition],[Final

Action],[Final Action Text],[BCC Address],[Train Action]

For example:

0,1,50,Rule_10,This_is_Rule_10,1,pbmf_match(sender:,contains,”spammer”),subject_rew rite,[Spam],[email protected],do_not_train

The following table describes the fields for the rules file:

Field

Policy

Stage

Rank

Name

Description

Enabled

Description

Policy ID of the rule. This will be 0 for a connection rule.

This will be 1 if the rule is an inbound content rule, 2 if the rule is an outbound content rule, and 0 if a connection rule.

The ordering of the rule in the given policy and stage. 1 is the highest priority, 2 is next highest priority, and so on.

The rule name.

Description of the rule.

This value will be 1 if the rule is enabled, and 0 if it is disabled.

User Guide 149

Content Control

Field

Condition

Final action

Final action data

BCC address

Train action

Description

Rule condition statement:

- trusted

- !trusted (not trusted)

- in_dict(messagepart,dictionaryID).

Such as in_dict(client_hostname,83)

- pbmf_match(messagepart, ptype, text).

Such as pbmf_match(sender:,contains,”spammer”) in the previous example.

messagepart : “env”, “helo”, “ip”, “client”, “env-addr”, “env-to”, “envfrom”, “body”, “content”, “token”, “acs”, “hdr”, “recipient”, “cc:”,

“from:”, “received:”, “reply-to:”, “sender:”, “subject:”, “to:”,

“message-id”.

ptype values: “contains”, “ends”, “starts”, “match”, “regex”.

text : The specified text string.

Boolean operators for “all” and “any” options:

&& - and, used with the “all” option

|| - or, used with the “any” option such as: trusted&&in_dict(sender_address,83)&&pbmf_match(subject:,con tains,”spam”)

Indicates the final rule action, including: “movem” (Quarantine),

“log”, “trash” (Discard), “reject”, “subject_rewrite”, “add_header”,

“redirect”, “postxenc” (Encrypt), “trust”, “relay”, “whitelist” (Accept),

“continue”.

Custom Pattern Filter actions including external Encryption and

Archiving if enabled: “actiona”, “actionb”, “actionc”, “actiond”,

“actione”, “action1”, “action2”, “action3”, “action4”, “action5”, and

“action6”.

Indicates any additional data for the action, such as the text for a modified subject or header, such as “[Spam]” in the previous example.

Contains a blind carbon email address such as [email protected].

This will be blank if no address is specified.

This field will be blank if set to the default “Intercept decides”.

Other values include: “do_not_train”, “train_spam”, and

“train_ham”.

150 WatchGuard XCS